CVE catalog

CVE-2026-102272

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON. This occurs when a public JWK is prefixed with a UTF-8 BOM and used in a mixed-algorithm verification path. As a result, public JWK bypasses asymmetric-key detection and becomes the HMAC secret. Consequently, an attacker who knows the public key can forge authenticated tokens. This issue is fixed in version 2.14.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpyjwtsid2.15.1-1fixed
Debianpyjwtforky2.15.1-1fixed
Debianpyjwttrixie2.10.1-2+deb13u1vulnerable
Debianpyjwttrixie-security2.10.1-2+deb13u1vulnerable
Debianpyjwtbookworm2.6.0-1+deb12u1not affected
Debianpyjwtbookworm-security2.6.0-1+deb12u1not affected
PyPIpyjwtNot reported2.14.0fixed
PyPIpyjwtNot reported2.14.0fixed
CpepyjwtNot reportedNot reportedunknown
Ubuntupyjwtnoble2.7.0-1ubuntu0.3fixed
Ubuntupython3-jwtnoble2.7.0-1ubuntu0.3fixed
Ubuntupyjwtpro1.7.0-2vulnerable
Ubuntupyjwtpro1.7.1-1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm1vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm2vulnerable
Ubuntupyjwtpro1.7.1-2ubuntu2.1+esm3fixed
Ubuntupyjwt22.041.7.1-2ubuntu2vulnerable
Ubuntupyjwt22.042.1.0-1vulnerable
Ubuntupyjwt22.042.3.0-1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.1vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.2vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.3vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.4vulnerable
Ubuntupyjwt22.042.3.0-1ubuntu0.5fixed
Ubuntupyjwt24.042.7.0-1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.1vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.2vulnerable
Ubuntupyjwt24.042.7.0-1ubuntu0.3fixed
Ubuntupyjwt26.102.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.102.12.1-1vulnerable
Ubuntupyjwt26.102.13.0-1vulnerable
Ubuntupyjwt26.102.13.0-1ubuntu1fixed
Ubuntupyjwt26.042.10.1-2vulnerable
Ubuntupyjwt26.042.10.1-3vulnerable
Ubuntupyjwt26.042.10.1-3build1vulnerable
Ubuntupyjwt26.042.10.1-4vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.1vulnerable
Ubuntupyjwt26.042.10.1-4ubuntu1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpyjwtsourcesid2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourceforky2.14.0-1not yet assignedNot reportedNot reported
Debianpyjwtsourcetrixie(unfixed)not yet assignedNot reportedNot reported
DebianpyjwtsourcebookwormNot affectedunimportantNot reportedNot reported
PyPIpyjwtPyPINot reported2.14.0Not reportedGHSA-R6X4-923Q-G947Not reported
PyPIpyjwtPyPINot reported2.14.0Not reportedPYSEC-2026-4150Not reported
Ubuntupyjwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Ubuntupython3-jwtdebnoble2.7.0-1ubuntu0.3Not reportedNot reportedNot reported
Ubuntupyjwtdebpro1.7.1-2ubuntu2.1+esm3Not reportedUBUNTU-CVE-2026-102272Not reported
Ubuntupyjwtdeb22.042.3.0-1ubuntu0.5Not reportedUBUNTU-CVE-2026-102272Not reported
Ubuntupyjwtdeb24.042.7.0-1ubuntu0.3Not reportedUBUNTU-CVE-2026-102272Not reported
Ubuntupyjwtdeb26.102.13.0-1ubuntu1Not reportedUBUNTU-CVE-2026-102272Not reported
Ubuntupyjwtdeb26.042.10.1-4ubuntu1.2Not reportedUBUNTU-CVE-2026-102272Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [python3-jwt]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

  • [python-jwt-doc]Affected

    Source package: [pyjwt]

    Details (4)

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

    • 2.10.1-2+deb13u1 · all · trixie-security

      Affected

      nvd · pyjwt · debian · 13

[Debian 12 (Bookworm)]

  • [python3-jwt]Not affected

    Source package: [pyjwt]

    Details (4)

    • 2.6.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · pyjwt · debian · bookworm

    • 2.6.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · pyjwt · debian · bookworm

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · pyjwt · debian · bookworm

    • 2.6.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · pyjwt · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]